https://souljian.cn/tags/%E8%AF%BB%E5%8F%96%E6%95%8F%E6%84%9F%E6%96%87%E4%BB%B6/Recent content in 读取敏感文件 on SoulJian小站Hugo -- gohugo.ioen-usSun, 30 Aug 2026 10:00:00 +0800https://souljian.cn/p/751088180/Sat, 29 Aug 2026 14:00:00 +0800https://souljian.cn/p/751088180/<h2 id="写在前面合法学习边界">写在前面：合法学习边界 </h2><p>目录穿越测试只在授权测试环境进行。</p> <h2 id="一目录穿越攻击链">一、目录穿越攻击链 </h2><img src="https://souljian.cn/img/path-traversal-chain.svg" alt="目录穿越攻击链" /> <div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">① 发现参数 → ② 构造 ../ → ③ 读取敏感文件 → ④ 结合文件包含 → RCE </span></span></code></pre></td></tr></table> </div> </div><h2 id="二利用方式">二、利用方式 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">../../etc/passwd </span></span><span class="line"><span class="cl">..%252f..%252fetc/passwd（双重编码） </span></span><span class="line"><span class="cl">..\..\..\windows\win.ini（Windows） </span></span><span class="line"><span class="cl">%2e%2e%2f%2e%2e%2fetc/passwd（URL编码） </span></span></code></pre></td></tr></table> </div> </div><h2 id="三防御加固">三、防御加固 </h2><div class="highlight"><div class="chroma"> <table class="lntable"><tr><td class="lntd"> <pre tabindex="0" class="chroma"><code><span class="lnt">1 </span><span class="lnt">2 </span><span class="lnt">3 </span><span class="lnt">4 </span></code></pre></td> <td class="lntd"> <pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">路径规范化：realpath/canonicalize </span></span><span class="line"><span class="cl">禁止 ../ 参数 </span></span><span class="line"><span class="cl">文件白名单限制 </span></span><span class="line"><span class="cl">WAF 规则拦截 </span></span></code></pre></td></tr></table> </div> </div><h2 id="四小结">四、小结 </h2><p>目录穿越的核心是<strong>用户可控路径参数被直接拼接</strong>。防御核心是<strong>路径规范化 + 白名单限制</strong>。</p>